🛡️ Sentinel: [Medium] Replace manual security headers with secureHeaders() middleware

[schmug]

🚨 Severity: MEDIUM
💡 Vulnerability: Manual security header assignments (c.header(...)) were being used in entrypoints (workers/app.ts, hub/src/index.ts). Manual assignment is prone to omission and typically covers fewer headers than a dedicated security middleware, increasing the risk of missing critical protections.
🎯 Impact: While some critical headers like X-Frame-Options and Strict-Transport-Security were set manually, others (e.g. X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy) were missing. This could leave the application unnecessarily exposed to specific classes of web vulnerabilities.
🔧 Fix: Replaced manual c.header calls with app.use("*", secureHeaders({ ... })) from hono/secure-headers, preserving explicit overrides like referrerPolicy and strictTransportSecurity while inheriting the additional default headers provided by the middleware.
✅ Verification: Ran npx @biomejs/biome lint, npm run typecheck, and the full Vitest suite (npm run test) to ensure no functionality is broken and all types match properly.

---

PR created automatically by Jules for task 6072395852230941896 started by @schmug

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ais-hub	8a75e20	Commit Preview URL Branch Preview URL	Jul 21 2026, 05:33 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	agentic-inbox	8a75e20	Jul 21 2026, 05:34 AM